IDS Policy manager Config

Procedure for Deployment of IDS Policy Manager for Centrally managing Snort sensor.

1). Set the Update locations of the policy/rule file

2). Create Policy for the IDS Sensors.below screen shows 2 Snort IDS Policies are created for managing 2 different Sensors.Intialize the Created Policy with the Base Config file Snort.conf and the latest downloaded rules tar file.

3). 2 IDS Sensors are created as shown below. Assign the created policy to this newly created IDS Sensor.

Separate Policies are assigned for each Sensors.

Same Policy is assigned for each Sensors.

After this upload settings must be configured to upload the latest rules/snort.conf and for this FTP port 21 must be enabled from this central server to the IDS Sensor. and DOS script is also required locally to manage  the stop/start of the sensor. 

Once the policies are updated successfully the Snort IDS Sensor needs to be restarted. 

Snort is not logging data to Database while running as Service.

The very important point in the troubleshooting of snort is always prefer to start it with the command line parameters b'cos  when you are starting it with the command lines it will display the complete trace of the commands in which we can figure out like the Ethernet Details if more then 1 ethernet cards are available on the server.

Snort as service is pointing a particular Ethernet and when u are explicitly defining in start commands you may be giving a different Ethernet details so, this is the root cause that why your snort is not logging into the database when running snort as windows/linux service

this can be verified by using the comand line params as shown below and try to run the snort also thro' the service and findout the difference.in my case the correct interface id is 1 and this can be verified by using below commands.

Check available Ethernet Cards
snort -W

Start snort in Verbose logging mode
snort -v -i1 -c D:\snort\etc\snort.conf -l D:\snort\log -K ascii

Installing / Uninstalling Snort as windows service
snort /SERVICE /INSTALL  -i1 -c D:\snort\etc\snort.conf -l D:\snort\log -K ascii

Enable Snort Syslog format and Redirect it to any required server

to enable Snort Syslog and Redirect it to any required server you need to modify the snort.conf file

output alert_syslog: host=ServerIP:514, LOG_AUTH LOG_ALERT LOG_INFO LOG_DEBUG

IBDATA1-HUGE Size Of MySQL Database

IBDATA1 is of approx 100GB consuming entire disk space of my server, it is a bug of mysql database or it is a common issue i dont know but to get out of the situation i simply followed below steps and everything back to normal with nominal initial database size.The one more way to get out of this is to truncate the tables with huge data but that doesn't reduced space occupied by this IBDATA file and hence the only way was to delete this file and generate the same by restarting the mysql server again .

Step 1).Stop Snort Server and take the Complete Backup of Snort Database (if Possible)

Step 2).If not possible, take the individual database backup of the following Databases.

archive

aw_hsc

idsevents

mysql

snort ( Except this Database) 

while taking the snort database backup, take the complete data with table scripts 

Following Tables needs to be backed up for restoring the snort database.

DETAIL

ENCODING

ICMPHDR

REFERENCE

REFERENCE_SYSTEM

SCHEMA

SENSOR

SIG_CLASS

SIG_REFERENCE

SIGNATURE

Usage: - Command to take the Individual Table Backup

mysqldump -u root -p <Database Name> <Table Name> > <FileName.sql>

e.g.

mysqldump -u root -p SNORT DETAIL > detailtable.sql

Step 3).Now stop the Database MySql Server

Step 4).Now Locate the Path of the ibdata1 file in my case the size is 100GB
D:\Program Files\MySQL\MySQL Server 5.0\data\ibdata1, Rename or Move these files ib_logfile0,ib_logfile1 and ibdata1 to some other location not accessible by MySql Database later we can delete these files.

Step 5). Now Rename the data folder of "D:\Program Files\MySQL\MySQL Server 5.0\Data" of the MySql Server.

Step 6). Create a folder named data under the location D:\Program Files\MySQL\MySQL Server 5.0\

Step 7). Copy & Paste the Existing mysql schema to this location

Step 8). Now import all Databases schemas except mysql as it is the MySQL Server's Database.

Step 9). Now Start the MySql Database it will create the ib_logfile0,ib_logfile1 and ibdata1 to its existing location with some default file size say 25MB.

Step 10). If the imported databases are not working fine then create the following Databases manually

archive

aw_hsc

idsevents

snort

Step 11). And Now Import the Dump to all the above databases one by one.

Step 12). Now for SNORT Database follow the following path.

12.1) Import the Create_Mysql.sql schema

12.2) Import the existing table data for the following tables which are taken from the existing working SNORT Database.

12.3) Now Start the Snort Server and Check whether it writes to database on not.

Step 13). Check the alerts of the table's iphdr, tcphdr, icmphdr, udphdr, If alerts/events are logged into the database it shows that your snort server database is working fine.

SCRIPTS FOR TABLE TRUNCATE

DELETE FROM DETAIL;

DELETE FROM ENCODING;

DELETE FROM ICMPHDR;

DELETE FROM REFERENCE;

DELETE FROM REFERENCE_SYSTEM;

DELETE FROM SCHEMA;

DELETE FROM SENSOR;

DELETE FROM SIG_CLASS;

DELETE FROM SIG_REFERENCE;

DELETE FROM SIGNATURE;

DELETE FROM EVENT;

OR simply import the schema for snort from the taken backup file.

Reference SQL Scripts :- Create_Mysql.sql (download link)

https://docs.google.com/leaf?id=0B56Gql-OtCzFMjdkMzVhNjQtMTgxZS00ZDk5LWE0ZmMtNmE4ZWNjNDhlYzcz&hl=en

Snort @ IDS

Today web sites are the most vulnerable, and therefore the most hacked. Snort a free and open source Network Intrusion Detection/Prevention System is the best tool for managing and preventing intrusions to your applications, and Internet-enabled programs or web sites, Snort can not only protect your sites, but it can analyze what's really going on with your networks, read more